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g i Abstract 

p,i We propose an easy implementable prepare-and-measure protocol for robust quantum key distri- 

bution with photon polarization. The protocol is fault tolerant against collective random unitary 

^h ■ channel noise. The protocol does not need any collective quantum measurement or quantum mem- 

ory. A security proof and a specific linear optical realization using spontaneous parametric down 

m 

J> ' conversion are given. 
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Introduction. Quantum key distribution (QKD)|l|,|2j * s one °f the most important ap- 
plication of the subject of quantum information. In constrast to classical cryptography, the 
security of QKD is guaranteed by elementary principles of quantum mechanics, and there- 
fore the unconditional security can be achieved. For security, we have to distill out a shorter 
final key, since Eavesdropper (Eve) may pretend her disturbance to be the noise from the 
physical channel. If the noise is too large, no final key can be obtained. To overcome this, 
one needs to design new fault tolerant protocols or new physical realizations for quantum 
key distribution. There are two approaches two this problem: one is to find a new proto- 
col which raises the threshold of channel noise unconditionally, such as the protocol with 
2 way classical communications J3|, y, |5(; the other way is first to study the noise pattern 
and then find a way to remove or decrease the noise itself, such as the various method to 
ca.ce! the collective ™»fl fl Q. So f, there a re various r ea liz atio ns using either the 
phase-coding [2j, [l8[ or the polarization information of single photons lfj, |20|. Those proto- 
cols using the phase-coding requires collective measurement at Bob's side. There are also 
proposals to remove the collective random unitary noise from the channeljy, [D,|S|. 

Here we raise a new proposal to reduce the channel errors, or, equivalently, to raise the 
noise threshold. Our method does not require Bob to take any collective measurement. Our 
method is based on the widely accepted assumptions that the flipping errors of polarization 
(mainly) come from the random rotation by the fiber or the molecules in the air, with 
the degree of the rotation fluctuating randomly. Also, if several qubits are transmitted 
simultaneously and they are spatially close to each other, the random unitaries to each of 
them must be identical, i.e., the error of the physical channel is collective. 
Main Idea. Consider an arbitrary collective random unitary U which satisfies 

J7|0) =cos0|O) + e i *sin0|l); 

U\l) = e iA (-e-^sin#|O) + cos0|l) (1) 

Here |0), |1) represent for horizontal and vertical polarization states respectively. Note that 
the parameters A, <fi and 9 fluctuate with time, therefore one has no way to make unitary 
compensation to a single qubit. However, the channel unitary error is a type of collective 
error to all qubits sent simultaneously, therefore it is possible to send qubits robustly because 
the collective errors on different qubits may cancel each other. With such type of collective 



unitary errors, we shall take the QKD in the subspace of two-qubit state of 

S = {|01>,|10». (2) 

In particular, we let Alice prepare and send Bob two-qubit states randomly chosen from 
|01), |10), l^) = -4(|01) ± |10)). Although state \ip~) keeps unchanged under the collective 
unitary errors jll|. the other 3 states do not keep unchanged. However, in our protocol, we 
shall let Bob first take a parity check to the two-qubit state to see whether it belongs to 
subspace S. If it does, he accepts it, if it does not, he discard it. The key point here is that, 
although the 2-qubit states could be distorted by the collective random unitary, most often 
the distortion will drive the codes out of subspace S therefore the distorted codes will be 
discarded by the protocol itself. The error rates to those accepted codes are normally small, 
provided that the channel noise are mainly from the collective unitary and the averaged value 
9 is not too large. For example, our protocol gives a good key rate if the averaged value 
| sin ^ | is 1/2. (The dispersion, <fi value can be arbitrarily large.) Explicitly, any collective 
rotation cannot exchange states \ip + ) and \ip~), it can only drive \ip + ) out of the subspace 
S. However, any state outside of S will be rejected, as required by our protocol. Therefore 
the rate of flipping between \ip + ) and ip~) (phase-flip rate) is zero. A collective rotation U 
will also take the following effects: 

[7® 2 |01) = £/|0)®[/|1) 
= cos 2 ^|01)-sin^cos^(e-^|00) + e^|ll)) + sin 2 ^|10). (3) 

U® 2 \10) = U\l) ® U\0) 
= cos 2 fl|10)-sin#cos%-^|00) + e^|ll)) + sin 2 fl|01). (4) 

Since the states outside the subspace S will be discarded, the net flipping between rate 
between 1 01) and 1 10) (bit-flip rate) r b = —i^^-i g ■ Therefore, if the average rotating angle 
is small, the flipping rate r b will be also small. (If we directly use BB84 protocol, the bit-flip 
rate is sin 2 9, one magnitude order larger than ours.) Moreover, in the ideal case that all flips 
come from the random rotation, since the phase-flip rate is zero, one can always distill some 
bits of final key provided that r b ^ 1/2. The key rate is 1 + r b log 2 r b + (1 — r b ) log 2 (l — r b ). 
Note that if r b > 1/2 one can simply reverse all bit values given by 1 01) and 1 10) and also 
distill some bits of final key. In practice, if 9 does not change too fast, we can divide the 



data into many blocks, say, each block contains the data with several seconds. We inverse 
the bit- values of those blocks with larger than 1/2 error rate after the decoding. Note that 
we assume the phase-flip error to be always very small by our protocol. 

Boileau et al|8[ has proposed a protocol with the collective random unitary error model 
recently. Our work differs from ref.J8j in the following aspects: 1). The main idea is dif- 
ferent. Ref. 8| uses the fact that state \i[)~) = -L(|01) — 1 10) ) is invariant under whatever 
rotations therefore the linear combinations of a few \ip~) at different positions will work 
robustly. We use a subspace of two qubit state. Our states are not always invariant under 
random rotations, however, the randomly rotation can drive the original state out of the 
specific subspace and never or rarely switch any two states inside the subspace. After Bob 
discards all those transmitted codes outside subspace S, the phase-flip error will be totally 
removed and the bit flip error will be significantly decreased. 2). The method is different. 
The protocol given by Boileau et al requires 3-qubit or 4-qubit entangled states, which could 
be technically difficult by currently existing technology. Our protocol only requires 2-qubit 
states which can be produced effectively. 3). The result is different. Since our protocol is 
BB84-likell|, we don't have to worry about the channel loss in practice. Boileau's protocol 
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is likely to be undermined by the channel loss, since it is B92-like|9|, llfj. In practice, the 
lossy rate for their protocol could be very high. Since they use at least 3 qubits to encode 
one, the joint survival rate is very low. 

Protocol 1 and Security Proof. For clarity, we now give a protocol with collective mea- 
surements first and then reduce it to a practically feasible protocol without any collective 
measurements. 

Protocol 1 1: Preparation of the encoded BB84 states. Alice creates a number of 
single qubit states, each of them is randomly chosen from {|0), |1), |±)}. She put down each 
one's preparation basis and bit value: state |0), |+) for bit value 0, the other 2 states are 
for 1. She also prepares ancillas which are all in state |0). She then encodes each indi- 
vidual qubit with an ancilla into a 2-qubit code through the following CNOT operation: 
|00) — > |01); |10) — ► |10); |11) — > |11); |01) — ► |00). The second digit in each state is for 
the ancilla. Such encoding operation changes (|0), |1)) into (|01), |10)) and |±) into \^ ± )- 2: 
State transmission. Alice sends those 2-qubit codes to Bob. 3: Error-rejection and 
Decoding. Bob takes the same CNOT operation as used by Alice in encoding. He then 
measures the second qubit in Z basis: if it is |1), he discards both qubits and notifies Alice; if 



he obtains |0), he measures the first qubit in either X basis or Z basis and records the basis 
as his "measurement basis" in the QKD protocol. The bit- value of a code is determined by 
the measurement outcome of the first qubit after decoding, |0), |+) for bit value 0, |1), |— ) 
correspond to 1. 4: Basis announcement. Through public discussion, they discard all 
those decoded qubits with different measurement bases in two sides. 5: Error test. They 
announce the values of some randomly chosen X bits and the same number of Z bits. If 
too many values disagree, they abort the protocol. Otherwise they distill the remained U Z 
bits" for the final key. 6: Final key distillation. Alice and Bob distill the final key from 
the remained "Z bits" by the classical CSS codell2ll. 
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The unconditional security here is equivalent to that of BB84JJJ, [12| with a lossy noisy 



channel: Protocol 1 can be regarded as an encoded BB84 protocol with additional steps 
of encoding, error rejection and decoding. If Eve. can attack Protocol 1 successfully with 
operation A during the stage of codes transmission, she can also attack BB84 protocol 
successfully with 

A' = E — > A — >R — ► D (5) 

during the qubit transmission and then pass the decoded qubit to Bob, where E, R, D are 
encoding, error rejection and quantum decoding, respectively. (The operation of encoding, 
error rejection or decoding does not requires any information about the unknown state itself.) 
Obviously, BB84 protocol with attack A' is identical to Protocol 1 with attack A. To Alice 
and Bob, BB84 protocol with Eve's attack A' is just a BB84 protocol with a lossy channel. 
(Eve must discard some codes in the error rejection step.) Therefore Protocol 1 must be 
secure, since BB84 protocol is unconditional secure even with a lossy channel. 
Protocol 2. Though we have demonstrated the unconditional security of Protocol 1, we do 
not directly use Protocol 1 in practice since it requires the local CNOT operation in encoding 
and decoding. We now reduce it to another protocol without any collective operations. First, 
since there are only 4 candidates in the set of BB84 states, instead of encoding from BB84 
states, Alice may directly produce 4 random states of 1 01), 1 10), \ip + ), \?P~)- Note that except 
for Alice herself, no one else can see whether the two-qubit codes in transmission are directly 
produced or the encoding result from BB84 states. One may simpl y p roduce the states of 
those 2-qubit codes by the spontaneous parametric down conversion J13I. ll4J . Second, in the 
decoding and error rejection step, Bob can carry out the task by post-selection. For all those 



codes originally in state |01) or |10), Bob can simply take local measurements in Z basis 
to each qubits and then discard those outcome of |0) ® |0) or |1) <g> |1) and only accepts 
the outcome |0) ® |1) which is regarded as a bit value and |1) £§> |0) which is regarded as 
bit value 1. The net flipping rate between 1 01) and 1 10) is regarded as bit-flip rate. The 
non-trivial point is the phase-flip rate, i.e., the net flipping rate between states \ip ). Note 
that all these codes only take the role of indicating the phase-flip rate, we don't have to know 
explicitly which one is flipped and which one is not flipped. Instead, we only need to know 
the average flipping rate between \ip ). To obtain such information, we actually don't have 
to really carry out the error rejection and decoding steps to each of these codes. What we 
need to do is simply to answer what the flipping rate would be if Bob really took the error 
rejection step and decoding step to each codes of l^). One straight forward way is to let 
Bob take a Bell measurement to each code which were in state \ij) ) originally. ( We shall call 
them ip + codes or ip~ codes hereafter.) For example, consider ip~ codes, after transmission, 
if the distribution over 4 Bell states \i{} + ), \ip~), |0 + ) 7 \4>~) are p^j- , p^+ , p^+ , p^- , respectively 
after the Bell measurements, we conclude that the channel flipping rate of \ip + ) — ► \ip~) 
is Pii)-/(Pi>+ +Pv~)- This rate is equivalent to the flipping rate of |+) — > |— ) in BB84 
protocol. Note that the rate of q^± have been excluded here since their corresponding states 
are outside of the subspace S and should be discarded by our protocol. 

Bell measurement is not the unique way to see the distribution over 4 Bell states for a set 
of states. We can also simply divide the set into 3 subsets and take collective measurements 
ZZ to subset 1, XX to subset 2, and YY to subset 3. We can then deduce the distribution 
over the 4 Bell states. Here ZZ, XX, YY are parity measurements to a two-qubit code in 
Z,X,Y basis, respectively. (Y : measurement basis of {|y±) = -75GO) ±z|l))}.) Note that 
lere classical statistics works perfectly because all these collective measurements commute 
15l Il6| . These collective measurements can be simply replaced by local measurements to 
each qubits since once we have done the results of local measurements of Z®Z, X®X, Y <g> Y 
we know the parity information. (In this paper, Z ® Z represents a local measurement to 
each qubit in Z basis; ZZ represents a collective measurement for the parity in Z basis.) 

Before going into the reduced protocol, we show the explicit relationship between the 
phase-flip rate and the local measurement results. Note that Bob has randomly divided all 
the received 2-qubit codes into 3 subsets and he will take local measurement Z ® Z, X <g> 
X, Y ® Y to each of the qubits of each codes in subset 1,2,3, respectively. Consider all ip~ 
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codes first. Denote e z ,e x ,e y for the rate of wrong outcome for ip~ codes in subset 1,2,3, 
respectively, i.e. the rate of codes whose two qubit has the same bit values in basis Z, X, Y, 
respectively. Given values z z ,x,y we immediately have 

P<t>+ + P<j>- = e z (6) 

2V+ + P<t>+ = e * ( 7 ) 

P1P+ + P<f>- = e„. (8) 

Our aim is only to see the flipping rate from \ip~) to \ip + ), other types of errors are discarded 
since they have gone out of the given subspace S. The net flipping rate from \ip~) to \ip + ) is 

, Pip+ _ £x ~r £y — £z / n \ 

P,p-+Pip+ 2(1 -e z ) 

In a similar way we can also have the formular for the value of t^+^^j,-, the flipping rate 

from \ip + ) to \ip~)~- 

e > _|_ e > _ e ' 
V^" = 2 (1 _ e g " ( 10 ) 

Here ^ x ,y,z are Ta ^ e °f wrong outcome in local measurement basis X <g> X, Y ® Y, Z <g) Z, 
respectively, to all codes originally in |^ + )- The total phase-flip error is 

tp = 2 ' v / 

Protocol 1 is now replaced by the following practically feasible protocol without any collective 
measurement: 

Protocol 2 1: Preparation of the encoded BB84 states. Alice creates a number of 2- 
qubit states and each of them are randomly chosen from {|01), |10), l^ 1 * 1 )}. For each 2-qubit 
code, she puts down "Z basis" if it is in state |01) or |10) or "X basis" ({|±)}) if it is in one 
of the states {^(|01) ± |10)). For those code states of |01) or {-^(|01) + |10)), she denotes 
a bit value ; for those code states of 1 10) or { -4= ( 1 01 } — |10)), she denotes a bit value 1. 2: 
Transmission. Alice sends all the 2-qubit codes to Bob. 3: Measurement. To each code, 
Bob measures the two qubits in a basis randomly chosen from {Z <g> Z,X ® X,Y ® Y}. For 
example, if he happens to choose basis Z <g> Z for a certain code, he measures each qubit of 
that code in Z basis. 4: Rejection of wrong results. Alice announces her "preparation 
basis" for each codes. Bob announces his measurement basis to each codes. For those codes 
originally prepared in 1 01} or |10), they discard the results if Bob has used a basis other 
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FIG. 1: (Color online) The source of two-qubit state. P: n/2 rotater. BS: beam splitter, M: 
mirror, NC: nonlinear crystal, p: pump light in horizontal polarization, ul: unitary rotator, u2: 
phase shifter, ul takes the value of 0, tt/2, 7r/4 to produce state |01), 1 10), \ip + ), respectively. u2 
can be either I or a z . 

than Z £g> Z . They also discard all codes outside the subspace S. 5: Error test. To all 
the survived results, they announce some bit values of codes originally in \ip + ) or \ip~). 
From the announced results they can calculate the phase-flip rate by formula fTTf . They can 
also estimate the bit-flip rate by annoucing some results of those survived codes which are 
originally in |01) or |10). 6: Final key distillation. Alice and Bob distill the final key 
from the remianed "Z bits" by using the classical CSS code[12]. (Since they only use U Z 
bits" for final key distillation, Alice can choose U Z basis" more frequently than U X basis" 
in Step 1.) 

Physical Realization of Protocol 2. There are two parts in the realization. One is the source 
for the required 4 different 2-qubit states at Alice's side. The other is the measurement 
device at Bob's side. Both of them can be realized with simple linear optical devices. 
The requested source states can be generated by SPDC process |l3|, |l4j as shown in figure 
1. The measurement with random basis at Bob's side can be done by a polarizing beam 
splitter(PBS) and a rotator driven electrically, as shown in figure 2. 

Another protocol for robust QKD with swinging objects. In some cases, especially in free 
space, the dispersion can be small while the random rotation angle 9 can be large. We 
consider the extreme case that <j) in unitary U is 0, or otherwise can be compensated to almost 
0, but 9 is random and can be arbitrarily large. The swinging angle of an airplane can be very 
large in certain case. We can exactly use the collective unitary model, with all elements in U 
being real if there is no dispersion. Then we have a better method. It is well known that both 
states |0 + ) and \ip~) are invariant under whatever real rotation. Any linear superposed state 
of these two are also invariant. Therefore we use the following for states {|0) = \(f) + ), |1) = 
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FIG. 2: (Color online) Measurement device at Bob's side. The rotator R offers a random rotation 
to both qubits in the same code. Each time, rotation is randomly chosen from unity, (|0), |1)) — ► 
(|+), |— )), (|0), |1)) — > (\y+), \y— ))■ The event of two clicks on one detector (Dl or D2) show that 
the 2 qubits of the code have the same bit value, two clicks on different detectors show that the 2 
qubits have different bit values. 

ir>; 1+') = ^(|0> + |1» = ^(|0)|+) - |l)|-»; I-') = ^(|0)|-> + |1)|+))}. Bob need not 
take any collective measurement to determine the bit value. If he chooses "Z" basis, he 
measure each of the two qubits in Z basis, 00 or 11 for bit value while 01 or 10 for bit 
value 1. If he chooses "X" basis, he measures the first qubit in Z basis and the second in 
X basis, |0)|+) or |1)|— ) for bit value and |0)|— ) or |1)|+) for bit value 1. There is no 
error-rejection step here because it is expected to be no error after decoding, given the real 
rorarion channel. Even for the QKD with fixed object there is still a little bit advantage: 
they do not need take any bases allignment with each other. Each of them only need to 
make sure their local measurement bases are BB84-like, i.e., the inner product of two bases 
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Concluding remark. We have given a robust QKD protocol in polarization space given that 

the collective random unitaries are dominant channels errors. Our protocol can obviously be 

extended to the 6-state-like protocol|l7| if we add one more candidate state of -W|0)±i|l))in 

the source. 
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Note Added: After the work was completed, a different novel protocol [21| for robust QKD 



has drawn our attention. 
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